WebBuilding

Foundations

Web hosting

Summary

Web hosting is the service of keeping a website's files and data on servers that stay connected to the internet, so that browsers can load the site at any time. Hosting began with organizations running their own machines, such as CERN's first web server in November 1990, and grew through free home-page services like GeoCities (1994 to 2009), shared hosting, virtual private servers and, from 2006, cloud services such as Amazon S3 and EC2. Today the main types are shared, VPS, dedicated, cloud and managed hosting, and website builders include hosting in their plans.

Web Building Encyclopedia · Foundations · Last reviewed October 22, 2026 · 10 min read

What web hosting is

Web hosting is the service of keeping a website’s files, and often its database, on a server that stays switched on and connected to the internet, so that anyone can load the site at any hour. A web host is the company that owns or rents those servers and sells space and computing power on them.

Three pieces work together when someone visits a site. The domain name is the address people type. The Domain Name System turns that name into the IP address of the host’s server. Web server software on that machine, such as the Apache HTTP Server or Nginx, then answers the browser’s HTTP request and sends back the page. The domain and the hosting are separate services, and they can come from different companies.1

Hosting plans differ mainly in how much of a server a customer gets and who looks after it. The table below sums up the common types. Each is described in more detail later in this entry.

TypeWhat is sharedWho maintains the serverMain trade-off
Shared hostingOne server, its software and usually its IP address, split among many customers2The host, which is often responsible for the server but not for the software a customer installs3The customer has no server to run, but a compromised neighboring site can put yours at risk3
Virtual private server (VPS)The physical machine, divided into virtual machines with their own operating systems4The host runs the physical machine; each guest operating system still needs the same security work, such as prompt updates, as one on real hardware4More control and separation, because each guest has its own operating system, though isolation between virtual machines is not complete4
Dedicated serverNothing: the whole physical machine serves one customer4The provider supplies the hardware and data center; who runs the software depends on the plan5No other customers on the hardware, so it can be secured for one service; NIST notes that critical services are usually given their own dedicated host4
Cloud hostingA large pool of servers, storage and networks6The provider runs the hardware; the customer runs what sits on top6Capacity can grow or shrink quickly and is metered, so bills follow use6
Managed hosting and hosted buildersA platform built for one kind of siteThe provider, including updates, backups and certificates7Less upkeep, but the site may be tied to the platform78

Early hosting: from one computer at CERN to free home pages

At first, publishing on the World Wide Web meant running a server yourself. The first web server, nxoc01.cern.ch, later called info.cern.ch, went online at CERN in November 1990, together with the first web page.9 It ran on Tim Berners-Lee‘s NeXT computer.10

Servers multiplied as other institutions set up their own. A snapshot of the web project’s page from November 1992 listed 26 reasonably reliable servers. W3C‘s history counts around 50 known HTTP servers in January 1993 and more than 200 by October 1993.9 On April 30, 1993, CERN put the web software in the public domain.10

Free hosting services then let people publish without owning a server. GeoCities was founded in 1994 as Beverly Hills Internet.11 Its members, whom it called Homesteaders, built their own pages on its servers. When Yahoo announced its purchase of the company in January 1999, it said more than 3.5 million Homesteaders had created over 32 million pages.12 CNNfn reported that GeoCities had 19 million unique visitors in December 1998, citing the research firm Media Metrix.13

Yahoo agreed to buy GeoCities on January 28, 1999, offering 0.3384 Yahoo shares for each GeoCities share.12 CNNfn described it as a $3.6 billion deal.13 Yahoo completed the purchase on May 28, 1999.14

Ten years later Yahoo closed the service. In April 2009 Yahoo announced that GeoCities would stop accepting new sign-ups, and it shut the service down on October 26, 2009.15 According to Computerworld, Yahoo’s FAQ made clear the pages were being deleted, so anything their owners or readers had not backed up would be lost. Volunteers in the Archive Team group, who estimated the content at about 10 terabytes, were downloading as much of it as they could.11

Shared hosting and control panels

Shared hosting puts many customers’ websites on one server. It became practical because of a change in the HTTP protocol. HTTP/1.1, published as RFC 2068 in January 1997, required browsers to send the site’s name in a Host header with each request.16 A server could then tell which of its many sites a visitor wanted, even when all of them shared one IP address.

The Apache documentation calls this name-based virtual hosting. Older IP-based virtual hosting needed a separate IP address for each site, while name-based hosting “eases the demand for scarce IP addresses.”2 Secure sites had the same problem a few years later, because the TLS protocol behind HTTPS gave a browser no way to name the server it was contacting. RFC 3546, published in June 2003, added an extension called Server Name Indication for servers that host many virtual servers at a single address.17

Shared hosts commonly give each customer a control panel, a set of web pages for managing files, email and databases without logging in to the server directly. The company behind one such panel, cPanel, says its founder started it in 1997 in his Wilmington, Delaware home as a teenager, and that cPanel joined the WebPros group in 2019. It now describes its product as a platform for automating web hosting.18

The same software supports reseller hosting. In cPanel’s documentation, a reseller is an account owner who also sells hosting accounts to other people. The reseller buys server resources from a hosting provider and divides them among its own customers.19

Sharing a server has costs. The WordPress security handbook says hosts are often responsible for the server infrastructure but not for the software a customer installs. It warns that on a shared server, a compromised neighboring site can put yours at risk even if you follow every other precaution, and that giving the web server write access to files is especially risky in a shared environment.3

Virtual private servers and dedicated servers

A virtual private server, or VPS, is a slice of a physical machine that behaves like a separate computer. NIST, the US standards agency, explains the underlying technique in its January 2011 guide to virtualization security. In full virtualization, operating systems run on simulated hardware called a virtual machine. Each copy of an operating system is a guest, and a program called the hypervisor, or virtual machine monitor, manages the guests on a host machine.4

Software for running virtual machines on ordinary servers followed. A paper by Paul Barham and colleagues at the University of Cambridge, presented in October 2003 at SOSP ’03 (the ACM Symposium on Operating Systems Principles), described Xen, a virtual machine monitor for ordinary x86 servers. It aimed to run up to 100 virtual machines on one modern server, with a performance cost of a few percent at most.20 Linux 2.6.20, released on February 5, 2007, added KVM, a driver that uses the hardware virtualization features of Intel and AMD processors.21

Each guest on a VPS gets its own operating system and applications, running in a separate virtual machine.4 That brings upkeep with it: NIST’s guide says every security consideration for an operating system on real hardware also applies to a guest, and advises installing guest updates promptly.4

The separation is real but limited. NIST’s guide says the hypervisor divides resources so that one guest cannot take another’s, which can make systems more reliable. It also notes that guests are often not completely isolated from one another, and that putting many servers on one host concentrates risk. For that reason, it says, critical services are usually kept on dedicated hosts.4

A dedicated server is a whole physical machine that a provider supplies to one customer, along with the facility it runs in. Colocation differs: the customer keeps ownership of its own hardware and rents space, power, cooling and network connections in a third party’s data center.5

Cloud hosting

Cloud hosting rents computing power from a large shared pool, by the hour or by the request, instead of as a fixed server. Amazon Web Services (AWS) launched two such services in 2006. Amazon S3, which AWS described as storage for the internet, was announced in March 2006.22 ADTmag reported prices of $0.15 per gigabyte of storage per month and $0.20 per gigabyte of data transferred.23 Sources give two dates: AWS’s announcement page is dated March 13, 2006, while Jeff Barr’s AWS blog post of March 14, 2021, says he announced S3 fifteen years earlier to the day, which points to March 14, 2006.2224

Amazon EC2 followed on August 24, 2006, in beta. AWS described it as a web service that “provides resizable compute capacity in the cloud,” starting new servers in minutes and billing only for capacity used.25 Jeff Barr of AWS wrote that each instance cost 10 cents per clock hour and was roughly equal to a 1.7 GHz Xeon processor with 1.75 GB of memory and 160 GB of disk.26

Other services took away more of the server work. Google App Engine, previewed on April 7, 2008, let developers run web applications on Google’s infrastructure. The preview was open to the first 10,000 developers, with each application limited to 500 MB of storage, and Google expected most applications to be able to serve around 5 million page views a month.27 GitHub Pages, launched on December 18, 2008, published web pages from a code repository: updating the site was as simple as pushing new files to GitHub.28 On November 13, 2014, AWS announced Lambda, which runs a customer’s code without the customer setting up, starting or watching any servers. It is billed per request and per 100 milliseconds of compute time.29

NIST published a standard definition of cloud computing in September 2011. It lists five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. It also names three service models.6

  • Infrastructure as a service (IaaS). The customer rents processing, storage and networks and can run any software, including operating systems, as on EC2.6
  • Platform as a service (PaaS). The customer deploys its own application with the provider’s tools and languages but does not manage the servers, as on App Engine.6
  • Software as a service (SaaS). The customer uses the provider’s application, usually through a browser.6 Hosted website builders fit here: Wix describes its own platform as a SaaS architecture that cannot be hosted elsewhere.8

Cloud providers set out their reliability promises in service level agreements, or SLAs. As of October 2026, the AWS compute SLA, last updated on May 25, 2022, commits to 99.99% monthly uptime for instances spread across two or more availability zones in a region, and 99.5% for a single instance. If it misses, customers receive service credits of 10%, 30% or 100% of the bill, depending on how far uptime fell.30 In a 30-day month, 99.5% uptime still allows about 3.6 hours of downtime.

Managed WordPress hosting and website builders

Managed hosting sells the server work as part of the plan. Some of it is built around WordPress, the open-source content management system that runs on PHP with a MySQL or MariaDB database.31 Automattic launched in December 2005 as the company behind the hosted service WordPress.com.32 WordPress.com’s own comparison says it “includes managed hosting, while WordPress.org requires you to find and manage your own,” and that updates, backups and SSL certificates are handled automatically.7

Companies selling managed WordPress hosting followed. WP Engine, for example, says it was founded in 2010 in Austin, Texas.33

A managed host still relies on services it does not control. On September 25, 2024, WordPress.org cut off WP Engine’s free access to its resources, including its update servers and its plugin and theme directories, during a trademark dispute covered in the WordPress entry.34

WordPress.org also publishes what it wants from any host. As of October 2026, it recommends PHP 8.3 or greater, MySQL 8.0 or greater or MariaDB 10.11 or greater, and HTTPS support. It advises asking a potential host what steps it takes to keep each account secure.31

HTTPS certificates are part of many hosting bundles, including WordPress.com’s.7 Let’s Encrypt opened its free, automated certificate service to everyone on December 3, 2015, with the stated aim of making HTTPS the default.35

Website builders take the bundle furthest. Squarespace says every Squarespace website comes with hosting and security, and lists SSL certificates, web application firewalls and protection against denial-of-service attacks.36 Wix sets up hosting automatically when a site is published, and says a Wix site has to be hosted and run on Wix’s own servers.8

The bundle limits where the site can go. Squarespace exports some content as a single XML file in a WordPress format, but not store pages, portfolio pages, style settings or custom CSS, among other things. After a move to self-hosted WordPress, images may still point to Squarespace’s servers and break when the Squarespace site is canceled.37

Timeline

  1. WordPress.org cuts off WP Engine's free access to its update servers and directories34
  2. Let's Encrypt opens free, automated HTTPS certificates to everyone35
  3. AWS announces Lambda, billed per request and per 100 milliseconds29
  4. NIST publishes its definition of cloud computing, SP 800-1456
  5. WP Engine is founded in Austin, Texas, to host WordPress sites33
  6. Yahoo shuts down GeoCities and deletes its pages15
  7. Google previews App Engine for running web applications27
  8. Linux 2.6.20 adds the KVM hypervisor21
  9. Amazon EC2 launches in beta25
  10. Amazon S3 storage service is announced22
  11. RFC 3546 adds Server Name Indication to TLS17
  12. Yahoo agrees to buy GeoCities12
  13. HTTP/1.1 (RFC 2068) requires the Host header used by name-based hosting16
  14. GeoCities is founded as Beverly Hills Internet11
  15. The first web server, nxoc01.cern.ch, goes online at CERN9

What it means for your website

Every website has a host, even when the bill does not say so. Your first job is to know which kind you have and what you could take with you.

  • Know what your plan includes. On Squarespace or Wix, hosting comes with the subscription. Squarespace exports only part of a site, and Wix says it does not support external hosting.378 On self-hosted WordPress, you choose the host and can move the whole site.
  • Keep the accounts in your name. Your domain, your hosting account and your backup storage should all be registered to you or your business, with logins you control. ICANN treats the domain registrar and the web host as separate services.1
  • Keep your own backups. A WordPress backup has two parts, the files and the database. The WordPress handbook suggests weekly backups for small sites and daily ones for busy sites, keeping at least 3 to 5 recent copies in different places. Host backups exist, but restoring from them can take time.38 Our glossary entry on website backups explains the options.
  • Ask a host four questions. Which PHP and database versions does it run, compared with WordPress’s recommendations?31 What uptime does it promise, and what do you get if it misses? The AWS compute SLA, for example, pays in service credits.30 What security steps does it take?3 And how do you get a full copy of your site out?
  • Plan a move before you need one. If the domain and URLs stay the same, a WordPress site moves by copying its files and database to the new host.39 You then point the domain at the new server by changing its nameservers or IP address.1 Keep the old plan running until the change has spread. Our guide to moving your website walks through each step.
  • Treat free hosting as temporary. GeoCities once held more than 32 million pages12 and still closed, deleting what owners had not saved.11

Our web hosting glossary entry gives the short definition, and our guide to domains and hosting covers what to check before you sign up.

See also

References

  1. FAQs for Registrants: Transferring Your Domain Name. ICANN. accessed October 22, 2026.
  2. Name-based Virtual Host Support. Apache HTTP Server Version 2.4 Documentation, The Apache Software Foundation. accessed October 22, 2026.
  3. Hardening WordPress. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.
  4. Guide to Security for Full Virtualization Technologies (NIST Special Publication 800-125), Karen Scarfone, Murugiah Souppaya and Paul Hoffman. National Institute of Standards and Technology. 2011-01. accessed October 22, 2026.
  5. What Is Colocation?. Supermicro. accessed October 22, 2026.
  6. The NIST Definition of Cloud Computing (NIST Special Publication 800-145), Peter Mell and Timothy Grance. National Institute of Standards and Technology. 2011-09. accessed October 22, 2026.
  7. WordPress.com vs. WordPress.org. WordPress.com Support, Automattic. accessed October 22, 2026.
  8. Exporting or Embedding Your Wix Site Elsewhere. Wix Help Center, Wix.com. accessed October 22, 2026.
  9. A Little History of the World Wide Web (created by Robert Cailliau, maintained by Dan Connolly). W3C. accessed October 22, 2026.
  10. The birth of the Web. CERN. accessed October 22, 2026.
  11. Yahoo GeoCities closes on Oct. 26 (Ken Gagne). Computerworld. 2009-10-23. accessed October 22, 2026.
  12. Yahoo to Acquire GeoCities (press release filed as an exhibit to Form 8-K). Yahoo Inc., U.S. Securities and Exchange Commission EDGAR. 1999-01-28. accessed October 22, 2026.
  13. Yahoo buys GeoCities. CNNfn, CNN Money. 1999-01-28. accessed October 22, 2026.
  14. Yahoo Inc. Form 10-Q, quarter ended June 30, 1999. Yahoo Inc., U.S. Securities and Exchange Commission EDGAR. 1999. accessed October 22, 2026.
  15. GeoCities closes its doors today (Maggie Holland). IT Pro. 2009-10-26. accessed October 22, 2026.
  16. RFC 2068: Hypertext Transfer Protocol, HTTP/1.1. Internet Engineering Task Force, RFC Editor. 1997-01. accessed October 22, 2026.
  17. RFC 3546: Transport Layer Security (TLS) Extensions. Internet Engineering Task Force, RFC Editor. 2003-06. accessed October 22, 2026.
  18. Company. cPanel, L.L.C.. accessed October 22, 2026.
  19. Guide to Reseller Accounts. cPanel and WHM documentation, cPanel, L.L.C.. accessed October 22, 2026.
  20. Xen and the Art of Virtualization (Paul Barham and others), SOSP '03, October 19 to 22, 2003, Bolton Landing, New York. ACM; author copy at University of Cambridge Computer Laboratory. 2003-10. accessed October 22, 2026.
  21. Linux 2.6.20. Kernel Newbies. 2007-02-05. accessed October 22, 2026.
  22. Announcing Amazon S3, Simple Storage Service. What's New, Amazon Web Services. 2006-03-13. accessed October 22, 2026.
  23. Storage infrastructure service for developers. ADTmag. 2006-03-14. accessed October 22, 2026.
  24. Amazon S3's 15th Birthday: It is Still Day 1 after 5,475 Days and 100 Trillion Objects (Jeff Barr). AWS News Blog, Amazon Web Services. 2021-03-14. accessed October 22, 2026.
  25. Announcing Amazon Elastic Compute Cloud (Amazon EC2), beta. What's New, Amazon Web Services. 2006-08-24. accessed October 22, 2026.
  26. Amazon EC2 Beta (Jeff Barr). AWS News Blog, Amazon Web Services. 2006-08-25. accessed October 22, 2026.
  27. Introducing Google App Engine + our new blog. Google App Engine Blog, Google. 2008-04-07. accessed October 22, 2026.
  28. GitHub Pages (Tom Preston-Werner). The GitHub Blog, GitHub. 2008-12-18. accessed October 22, 2026.
  29. AWS Lambda: Run Code in the Cloud (Jeff Barr). AWS News Blog, Amazon Web Services. 2014-11-13. accessed October 22, 2026.
  30. Amazon Compute Service Level Agreement. Amazon Web Services. 2022-05-25. accessed October 22, 2026.
  31. Requirements. WordPress.org. accessed October 22, 2026.
  32. Automattic (Milestones: The History of WordPress). WordPress.org. 2015-11. accessed October 22, 2026.
  33. About us. WP Engine. accessed October 22, 2026.
  34. WP Engine is banned from WordPress.org (Matt Mullenweg). WordPress.org News. 2024-09-25. accessed October 22, 2026.
  35. Entering Public Beta (Josh Aas). Let's Encrypt, Internet Security Research Group. 2015-12-03. accessed October 22, 2026.
  36. Website hosting. Squarespace. accessed October 22, 2026.
  37. Exporting your site. Squarespace Help Center. accessed October 22, 2026.
  38. WordPress Backups. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.
  39. Moving WordPress. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].